Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
2
votes
0answers
60 views
+50

How hard is it to link a hardened BIP32 child public key to it's parent public key?

The BIP32 spec says this in the security section: ...
1
vote
0answers
23 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8?

In Cryptographic Algorithm Validation Program for KDF document, here, page 9, it says "If a field size that is not a multiple of 8 bits, the shared secret is represented by a string of bytes that ...
0
votes
0answers
39 views

How to Derive a Child RSA Key Pair from an Existing RSA Key Pair?

I want to understand how, using standard tools like openssl (or similar), to derive a child RSA key pair from an existing RSA key pair. Additionally I would like the derived key to contain a ...
0
votes
1answer
65 views

KDF for generating RSA and ECC keys from a 2048 bit secret

Do KDFs exist for generating RSA and ECC keys from a 2048-bit random secret?
0
votes
0answers
61 views

Are My Answers to This AES Question Correct?

Question I am extremely new to cryptography and AES and so I am not confident that I did this question orrectly. Please can you check my answers and let me know if anything jumps out as incorrect, ...
0
votes
0answers
29 views

KDF options for a ECDH shared secret

the answer to this question suggests that the x-coordinate of an ECDH shared secret is itself usable as an encryption key without apply a KDF.... if so, then what additional security is provided by ...
5
votes
1answer
404 views

Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

I'm using AES-CBC-256 with PKCS#7 compatible padding. I already have 32 bytes that come from a 'cryptographically secure random number generator'. In this scenario, does it make sense to use PBKDF2 to ...
1
vote
2answers
46 views

Meaning of the term “Key Material”

I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times. I used Google to look for what the term means. ...
1
vote
1answer
46 views

Secure password reset

In my model I use two different keys, one for authentication and the other for the encryption / decryption of the data that the user saves, each derived from the master password with a KDF function. ...
0
votes
2answers
50 views

KDF and salt storage

Regardless of the KDF I will use, let's imagine that I have to generate two keys, one for authentication and the other for encryption (which will always remain on the device that generates it until ...
6
votes
1answer
101 views

Is Argon2id safe from the discovered Argon2i issues?

So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given ...
0
votes
0answers
46 views

Apply HKDF After DIffie-hellman Key Exchange

Im trying to use HKDF after DIffie-hellman key exchange. However, i got stuck on HKDF part. ...
0
votes
1answer
34 views

How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for ...
1
vote
1answer
45 views

Computationally expensive key derivation whose difficulty is asymmetric

I am looking for a primitive or a construction that meets the following requirements. Is such a construction (a) theoretically possible, and (b) in existence right now? Given are: a long secret $X$ ...
2
votes
5answers
153 views

How passwords are fed to key derivation functions?

Suppose I want to encrypt data, send it over the network, and decrypt it on the receiver side. I know the elegant way to do this is by using a symmetric key to encrypt the data and an asymmetric key ...
1
vote
1answer
49 views

DHE parameters: which parameters need to be random each time?

In DH key exchange, first, both parties need to agree on a generator $g$ and prime $p$. After that each party computes its key (party A: $g^a \bmod p$) and (party B: $g^b \bmod p$), then they exchange ...
2
votes
1answer
128 views

ChaCha20-Poly1305: Can my salt/pass for a KDF also be the nonce?

I have a PSK. I don't want to use it directly. I want to pass a "salt"/password into a KDF and get a new key for authenticated encryption with ChaCha20-Poly1305 . I need to give the other side the ...
0
votes
0answers
28 views

Using PSK starting a new session, encrypt the new session key with old, or sign a derivative to be used on the old key?

I have two endpoints that go through a middleman. Both have a pre-shared and secure key, 16bytes to be used with ChaCha20-Poly1305. Extremely constrained device. No packet larger than 100 bytes total. ...
1
vote
1answer
109 views

TDES (Triple DES) DUKPT decryption

We have a POS (Ingenico) that uses DES3-CBC encryption using a derived key. It sends encrypted data, and 10 bytes size Key Serial Number (KSN). I tried to use ...
0
votes
0answers
44 views

KDF3 - implementation explanation

An old project that I did not code is using the KDF3 algorithm, but I struggle to find an explanation about the way this key derivation algorithm works. I know that this algorithm is part of the ISO-...
0
votes
2answers
110 views

Is it safe to use a deterministic salt as an input to KDF (Argon2)?

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext records in the ...
1
vote
1answer
65 views

Derived keys usable by threshold signatures

Suppose there are $n$ members in a $(t,n)$ threshold signature scheme. The global secret key $sk$ is not known to any single party, as the keys are generated distributed. The parties are able to ...
0
votes
0answers
46 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
0
votes
0answers
15 views

Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]

there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm. I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
0
votes
1answer
65 views

Multiple random keys vs multiple keys derived from master key

If Alice is going to share a symmetric encryption key and a kmac key with Bob using asymmetric encryption (sign with static key, encrypt with ephemeral keys - an authenticated KEM), what are the ...
4
votes
1answer
779 views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
0
votes
0answers
49 views

ZKA Approval Scheme

I'm having hard time finding any resources for ZKA (Zentraler Kreditausschuss Approval) security schematics used by IFSF Part 3-21 Security Standard (https://ifsf.org/documents/ifsf-standards/). ...
1
vote
1answer
59 views

“Safe” or Safest Method for Non-Hardened Key Derivation Functionality

I'm currently working on the development of an unorthodox system in which, ideally, there would be one master key pair, with thousands of keys derived from it. There needs to be a way to prove that ...
2
votes
1answer
196 views

Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

Encrypting with AES-256 is widely claimed to be post-quantum secure. But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a ...
1
vote
0answers
54 views

aeskeygenassist with only one imm8

I'm analyzing a binary which for its AES encryption, its only calling aeskeygenassist once and for the last argument (imm8, the ...
5
votes
3answers
452 views

Why RSA-KEM is more secure than Textbook-RSA?

I am studying RSA-KEM but I can not see why it should be as secure as padding RSA messages (e.g with RSA-OAEP) when exchanging a key between two parties (say A and B). It is easy to see that Textbook-...
1
vote
1answer
90 views

Key-Agreement & Key-Transport for Symmetric Authentication System

Question: I want to know what kind of Master Key sharing process is pursuit on Symmetric encryption environments (strictly symmetric, also in the key sharing scheme). As I am aware there are several ...
0
votes
2answers
92 views

Would XOR'ing two Argon2 keys add extra security?

When a user registers on the app, they need to provide a password they create and we provide them with a randomly generated passphrase (e.g. Apple Cat Ladder Fire). We then use Libsodium's ...
0
votes
0answers
62 views

memory-hard KDF that's just a giant permutation?

Why aren't there memory-hard KDF functions that simply build a 1GB permutation and permute it? Then hash the 1GB result. For example, use a hash function (unfixed output mode) on the key+salt and use ...
1
vote
1answer
215 views

Why use PBKDF2 over SHA-512 to derive AES encryption key? [duplicate]

Suppose I am using user passwords to derive AES-128-CBC encryption key. This key will be used to encrypt some sensitive data for the user so that even the website owner / operator can not decrypt it. ...
2
votes
2answers
90 views

Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?

Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
5
votes
2answers
172 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
0
votes
1answer
261 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
3
votes
1answer
59 views

Is there more than one public key for a private key?

Does deriving the public key from an RSA private key always yield the same result? And if so, does this generally apply to all asymmetric cryptosystems?
1
vote
2answers
132 views

Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
1
vote
0answers
44 views

Key derivation scheme with shared secrets?

I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
5
votes
1answer
338 views

Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?

See this answer that explains the following sequence of operations: CipherText = IV|| AES(key1,iv,message) tag = hmac(key2,ciphertext) That answer says, You ...
1
vote
1answer
283 views

Station-to-Station protocol questions

Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys. Alice sends Bob her public key $A_K$ Bob receives $A_K$ and computes ...
1
vote
0answers
55 views

RSA Modulus doesn't match the primes [closed]

I generated a 2048-bit RSA key with ssh-keygen. When running: openssl rsa -in key -noout -text The result is: ...
0
votes
1answer
98 views

Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
5
votes
2answers
232 views

Key derivation on Arduino

The ATmega2560 is slow - it's a single core, 16MHz 8-bit AVR. Despite that, I need to use some encryption on it, and since it is limited to a few blocks, AES-256 can be used. However, the key ...
3
votes
2answers
793 views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
0
votes
0answers
28 views

Rekeying procedure - how “far” from bijection?

Imagine that I want to change the key in order to prevent side-channel attacks on key and to protect against big load on the one key. It is desirable that key change procedure would look like random ...
2
votes
2answers
107 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "slow" memory. The ...
4
votes
3answers
981 views

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity). Here is how my encryption scheme is: ...

1
2 3 4 5
10